Best Way to Protect VBA Code in Excel

In order to properly discuss the best way to protect VBA code, the “VBA code protection” term needs to be defined first, as well as the criteria of its efficiency.

Let’s consider the term ‘VBA code protection’ as protection from accessing the VBA source code and protection from VBA code algorithm restoration.

To compare different VBA code protection methods, we need to have a measurement which directly shows the effectiveness of each method. The best measurement would be economical—how many resources were used to produce VBA code and what is the cost of the restoration of this code or algorithms from the protected code. Effective and reliable protection should have cost of recovering VBA source code from protected code significantly higher than cost of creating the same VBA code from scratch. It should become economically disadvantageous to recover VBA code in this case, because it is cheaper to create this VBA code from scratch than to recover it from the protected code.
In this context it makes sense to consider VBA projects of moderate to high complexity that have developing time of 100 work hours and more.

If W is defined as the work hours it took to create the VBA code and X as the amount of work hours to crack this protection to get access to the protected VBA code or restore the VBA code algorithms, then the relation between these quantities gives us the quality of VBA source code protection:

Also, many cheap commercial tools are available on the market to remove VBA password. Recovering the VBA code access in this case is automated and cost may be considered as equal to zero (X = 0).

This method has low protection efficiency.

Unviewable VBA Project

There is a way to make VBA Project unviewable by altering several bytes of the file in a HEX-editor (or programmatically) in an Excel workbook or Excel Add-In file. After such changes, the Excel VBA Project shows the “Project unviewable” message and blocks access to the VBA source code. But you need to understand that such restrictions exist only in the Microsoft VBA editor. There are several software products which allow you to see the VBA source code of the unviewable VBA project. One such software is open source LibreOffice package.
This method has the low protection efficiency (X < W) and may be considered as protection from accidental changes of the VBA code by customer.

VBA code obfuscation

Obfuscation of VBA source code includes changing names of methods, variables, and constants to random, difficult to read names, as well as removing comments and VBA code indenting to reduce understanding of the code.

In case of obfuscating, the structure of the algorithm is left unchanged and may be traced to recover the algorithms. There is existing software which allows to recover obfuscated VBA code formatting and increase the readability of the obfuscated source code. http://www.vbindent.com

Simple features of any text editor such as “Find and Replace” lets you change obfuscated names to more readable and meaningful ones.

Practically, VBA obfuscators do not protect VBA code, because tracing of the code allows to recover all of the VBA source code logic.

So, in the case of obfuscation the VBA code protection efficiency is low. X < W (definition of X and W see above).

Translating VBA code to another programming language

The goal of this approach is to move VBA code logic into DLL and call DLL methods from VBA code.

This is the most efficient VBA code protection approach. Because the VBA source code is converted into binary code of the EXE or DLL files.

The target language should be a compiled programming language, because any interpreting language (like VBA itself) doesn’t give efficient protection.

The main drawbacks are the high cost and the error prone nature of this approach.

Consider the situation when the translation to a compiled programming language does not cover the whole VBA project code but only several VBA methods. In this case the X value should be corrected.

The cost of recovery of smaller, protected parts is obviously much less than the restoration of the VBA code as a whole. If the cost of re-writing such methods is less than recovering them from compiled modules then X gets this reduced cost and the efficiency of such protection goes down.

Below we consider the most popular languages for this approach—Visual Basic 6, .NET (C# or Visual Basic.NET), C/C++.

VBA to Visual Basic 6 (VB6)

Visual Basic 6 (VB6) is an interpreted language but it also has the ability to compile VBA code into an EXE file or an ActiveX DLL.

The advantage of using this language lies in the simplicity of VBA to VB6 conversion. VB6 has the same syntax and semantics as VBA so you do not need to change a lot during code conversion.

Drawbacks:

VB6 doesn’t have 64-bit version, so in case of creation ActiveX Excel Add-In DLL it will be possible to use the compiled DLL from Excel 32 bit only.
VB6 is an interpreting programming language, so all of its byte-code is saved inside the compiled EXE or DLL file. This means that even after compilation into an EXE or DLL file it may be decompiled into readable VB6 source code by VB-Decompiler.

So, with a ‘VB-Decompiler’ the protection code efficiency of this approach is reduced to the level of the VBA code obfuscation approach.

Low protection efficiency (X < W see above).

VBA to VB.NET

In contrast to VB6, the .NET languages can create 32-bit as 64-bit versions of EXE and DLL files.

Converting VBA to .NET has the drawback in its architecture for resolving the VBA code protection tasks. It has a powerful ‘reflection’ mechanism which allows to convert the compiled code of .NET assembly into original source code. So, after conversion of the VBA code to .NET it is possible to restore the source code from the created .NET assembly.

It is possible to apply code obfuscation to .NET assembly, but efficiency of obfuscation has already been discussed above.

Low protection efficiency (X < W see above).

VBA to C or C++

Translation VBA code into C or C++ code gives very effective VBA code protection. The source code restoration from compiled C/C++ EXE or DLL file of not a trivial project – is very difficult task. In fact, it is so difficult and expensive that we can say it is practically impossible.

However, this approach has big drawback—C/C++ and VBA are very different programming languages. Conversion of VBA code to C/C++ is difficult and error prone, so the cost of such conversion not a trivial project is equal to the cost of creating the whole project from scratch.

High protection efficiency (X > W or X/W > 100 see above).

VbaCompiler for Excel

VbaCompiler is Excel VBA protection software. It converts the VBA source code to C language code and then compiles it into native Windows DLL. The efficiency of the protection is the same as manual conversion of VBA to C/C++ language that was discussed above, but without the main drawbacks of the manual VBA to C/C++ conversion approach. VBA compiler converts VBA code to DLL automatically, without the participation of a developer in the process. You do not need to have any knowledge of C or C++ languages in order to use VBA compiler.

This means that the main drawback of the high cost of VBA to C/C++ conversion is eliminated.

High protection efficiency (X > W or X/W > 100 see above).

With VbaCompiler for Excel you have the best VBA code protection efficiency without the high cost of VBA to C/C++ code conversion work.